Use-After-Free Vulnerability in Linux Kernel's Framebuffer Driver by Linux

CVE-2026-43497

What is CVE-2026-43497?

This vulnerability within the Linux kernel's framebuffer subsystem can lead to a use-after-free condition due to improper management of memory mappings on framebuffer pages. Specifically, the dlfb_ops_mmap function fails to set vm_operations_struct for the Virtual Memory Area (VMA), which prevents the kernel from tracking active memory maps. As a result, when the framebuffer backing is reallocated, any existing PTEs (Page Table Entries) remain valid, allowing userspace processes to continue accessing memory that has already been freed. This flaw could lead to unintended data disclosure or crashes, particularly under scenarios involving USB disconnects and framebuffer reallocation. Enhanced mechanisms have been introduced to manage mapping counts and safeguard against these risks.

References